The :func:`urlparse` API does not perform validation. See :ref:`URL

parsing security <url-parsing-security>` for details.

The :func:`urlsplit` API does not perform validation. See :ref:`URL

parsing security <url-parsing-security>` for details.

The :func:`urlsplit` and :func:`urlparse` APIs do not perform **validation**

of inputs. They may not raise errors on inputs that other applications

consider invalid. They may accept and pass through some inputs that might

not be considered URLs elsewhere as unusually split component parts. Their

purpose is for practical functionality rather than purity.

Instead of raising an exception on unusual input, they may instead return

some components as empty ``""`` strings. Or components may contain more than

perhaps they should.

We recommend that users of these APIs where the values may be used anywhere

with security implications code defensively. Do some verification within

your code before trusting a returned component part. Does that ``scheme``

make sense? Is that a sensible ``path``? Is there anything strange about

that ``hostname``? etc.

What constitutes a URL is not universally well defined. Different

applications have different needs and desired constraints. For instance the

living `WHATWG spec`_ describes what user facing web clients such as a web

browser require. While :rfc:`3986` is more general. These functions

incorporate some aspects of both, but cannot be claimed compliant with

either. Our APIs and code with expectations on their behaviors predate both

standards. We attempt to maintain backwards compatibility.